Hotel Exposes Booking Site Credentials in Plain Sight

"Shared logins end up written somewhere convenient." That blunt diagnosis came from Neycho Tepavicharov after he spotted a hotel's Booking.com administrative username and password scrawled on a whiteboard in a back room behind the front desk.

Neycho Tepavicharov's discovery in a London hotel

Neycho Tepavicharov, co-founder of Flashcloud, was staying at a hotel in London when he noticed an open door behind the front desk. Inside the back room, Tepavicharov found a whiteboard that displayed the property's Booking.com administrative username and password in plain English. He described the credentials as visible enough that "anyone near the desk could clearly see the login information," and said a passerby could have simply photographed the board for later use.

Booking.com administrative credentials left in plain view

The exposed information was not hidden or ephemeral. Tepavicharov emphasized how easily accessible the credentials were: visible on a whiteboard in a location staff used for convenience. The hotel's approach—one shared login for the whole team—had produced an obviously discoverable record of administrative access.

Risks to guests and hotel operations

Tepavicharov spelled out the practical consequences of that exposure. "With that login, someone could change or cancel reservations, see guests’ names and contact details, or message guests pretending to be the hotel," he said. He added that "fake 'please confirm your payment' messages sent from compromised hotel accounts are a well-known scam," underlining how attackers could exploit legitimate accounts to target guests. Whether the whiteboard alone would permit account takeover, Tepavicharov noted, depended on the Booking.com account's security settings — for example, whether additional authentication controls were in place.

Hotel manager reaction and migration to Flashcloud

After finding the credentials, Tepavicharov approached the hotel manager to show what he had seen. He reported that the manager was "mortified and very grateful." Following that conversation, the hotel changed its practices and moved its website to Tepavicharov's hosting service, Flashcloud. According to Tepavicharov, staff had not recognized the arrangement as a security risk; it had been "just the easiest way for the whole team to share one login."

What this means for hotel managers, guests, and security teams

• Hotel managers: The immediate, concrete step is to stop using a single shared login for administrative access. Tepavicharov's advice was explicit: "Give each staff member their own login, turn on two-factor authentication, and keep passwords in a password manager, not on the wall." The manager in this incident acted after being alerted; other properties may not be so lucky.
• Guests: Visible account compromise can enable convincing social-engineering scams. Tepavicharov highlighted that attackers able to message guests from a hotel's account can request payment confirmations and other sensitive actions — messages that may seem legitimate because they come from a trusted source.
• Security teams and technologists: Tepavicharov recommended per-user credentials and additional authentication controls, noting earlier in his account that organizations should "give each user dedicated credentials with their own separate login, and use multi-factor authentication." He also urged the use of password managers rather than ad-hoc schemes like whiteboards.

Tepavicharov summed the episode up with a familiar refrain: "The lesson is an old one, but it keeps happening." In this case, a guest's observation led to an immediate remediation — the hotel altered its practices and transferred website hosting to Flashcloud — but the incident is a compact illustration of how convenience can create large, avoidable risk. The fix here depended on chance: someone who knew what to look for saw the credentials, intervened, and the hotel acted. That sequence underlines how routine operational practices — choosing shared logins over individual accounts, writing passwords on a wall — remain a recurring vulnerability.

Read the original report on The Register: London hotel put admin login for booking website on whiteboard behind the front desk